Talk:Separate LAN and WLAN

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 06:34, 9 July 2007 (edit)
Piska23 (Talk | contribs)
(check it out)
← Previous diff
Current revision (20:54, 14 February 2020) (edit) (undo)
Tag (Talk | contribs)
(iptables vs. ebtables? - Add an alternative leaving the wireless interfaces unbridged)
 
(7 intermediate revisions not shown.)
Line 12: Line 12:
== dnsmasq errors out with Can't bind 192.168.1.1 socket already in use == == dnsmasq errors out with Can't bind 192.168.1.1 socket already in use ==
-== google34 ==+== iptables vs. ebtables? ==
 +Is there any reason that isolation of (bridged) wireless interfaces can't be achieved with ebtables? As far as I can tell, I have been able to isolate both wireless interfaces with the following startup script:
-[url=http://adorable.awardspace.info/adorable-girl.html ] adorable girl [/url]+ insmod ebtables
 + insmod ebtable_filter
 + insmod ebtable_broute
 + insmod ebt_ip
 +
 + #DHCP
 + ebtables -t filter -I INPUT 1 -p IPv4 --ip-proto udp --ip-dport 67 -j ACCEPT
 + #DNS
 + ebtables -t filter -I INPUT 2 -p IPv4 --ip-proto udp --ip-dport 53 -j ACCEPT
 + ebtables -t filter -I INPUT 3 -p IPv4 --ip-proto tcp --ip-dport 53 -j ACCEPT
 + #PROTECT ROUTER
 + ebtables -t filter -I INPUT 4 -p IPv4 -i eth1 --ip-dst 192.168.0.0/16 -j DROP
 + ebtables -t filter -I INPUT 5 -p IPv4 -i eth2 --ip-dst 192.168.0.0/16 -j DROP
 +
 + #ISOLATE
 + ebtables -t filter -I FORWARD 1 -i eth1 -j DROP
 + ebtables -t filter -I FORWARD 2 -i eth2 -j DROP
 + ebtables -t filter -I FORWARD 3 -o eth1 -j DROP
 + ebtables -t filter -I FORWARD 4 -o eth2 -j DROP
 +
 + #DHCP
 + ebtables -t filter -I OUTPUT 1 -p IPv4 --ip-proto udp --ip-sport 67 -j ACCEPT
 + #DNS
 + ebtables -t filter -I OUTPUT 2 -p IPv4 --ip-proto udp --ip-sport 53 -j ACCEPT
 + ebtables -t filter -I OUTPUT 3 -p IPv4 --ip-proto tcp --ip-sport 53 -j ACCEPT
 + #PROTECT ROUTER
 + ebtables -t filter -I OUTPUT 4 -p IPv4 -o eth1 --ip-src 192.168.0.0/16 -j DROP
 + ebtables -t filter -I OUTPUT 5 -p IPv4 -o eth2 --ip-src 192.168.0.0/16 -j DROP
-[url=http://adorable.awardspace.info/cute-and-adorable-kitten.html ] cute and adorable kitten [/url]+--[[User:Tag|Tag]] 08:06, 14 February 2020 (CET)
- +: Or, after removing from br0, why is it necessary to attach to a new bridge? Leaving the wireless interfaces unbridged leads to a nice, succinct startup script:
-[url=http://adorable.awardspace.info/adorable-boy.html ] adorable boy [/url]+ iptables -I FORWARD 1 -i eth1 -o ! vlan2 -j DROP
- + iptables -I FORWARD 2 -i eth2 -o ! vlan2 -j DROP
-[url=http://adorable.awardspace.info/24-adorable-baby-costume-easy-infant-make-outfit-toddler.html ] 24 adorable baby costume easy infant make outfit toddler [/url]+: --[[User:Tag|Tag]] 21:54, 14 February 2020 (CET)
- +
-[url=http://adorable.awardspace.info/adorable-pussy.html ] adorable pussy [/url]+
- +
-[url=http://adorable.awardspace.info/utterly-adorable-cat.html ] utterly adorable cat [/url]+
- +
-[url=http://adorable.awardspace.info/adorable-blogspot-com-french-href-juicy-nympho-orgasm-teenienympho498.html ] adorable blogspot com french href juicy nympho orgasm teenienympho498 [/url]+
- +
-[url=http://adorable.awardspace.info/adorable-pup.html ] adorable pup [/url]+
- +
-[url=http://adorable.awardspace.info/adorable-ass.html ] adorable ass [/url]+
- +
- +
-<a href= " http://doggystyle.awardspace.us/chubby-doggie-style.html " > chubby doggie style </a>+
- +
-<a href= " http://doggystyle.awardspace.us/skinny-doggie-style.html " > skinny doggie style </a>+
- +
-<a href= " http://doggystyle.awardspace.us/cant-doggie-enough-get-style-that-wife.html " > cant doggie enough get style that wife </a>+
- +
- +
-<a href= " http://doggystyle.awardspace.us/peter-north-doggie-style-with.html " > peter north doggie style with </a>+
- +
-<a href= " http://cum.awardspace.com/vaginal-cum-shot.html " > vaginal cum shot </a>+
- +
-<a href= " http://cum.awardspace.com/teen-cum.html " > teen cum </a>+
- +
-<a href= " http://cum.awardspace.com/anal-cum.html " > anal cum </a>+
- +
-== check it out ==+
- +
- +
-[url=http://banging.awardspace.info/teacher-banging-student.html ] teacher banging student [/url]+
- +
-[url=http://cum.awardspace.com/vaginal-cum-shot.html ] vaginal cum shot [/url]+
- +
- +
-[url=http://cum.awardspace.com/anal-cum.html ] anal cum [/url]+
- +
-[url=http://cum.awardspace.com/ts-cum.html ] ts cum [/url]+
- +
-[url=http://cum.awardspace.com/hand-job-cum-shot.html ] hand job cum shot [/url]+
- +
-[url=http://cum.awardspace.com/milf-cum.html ] milf cum [/url]+
- +
- +
-<a href= " http://banging.awardspace.info/banging-hard-pussy.html " > banging hard pussy </a>+
- +
-<a href= " http://banging.awardspace.info/gang-banging-sex.html " > gang banging sex </a>+
- +
-<a href= " http://ball-licking.awardspace.us/licking-gay-ball.html " > licking gay ball </a>+
- +
-<a href= " http://ball-licking.awardspace.us/ball-licking-gallery.html " > ball licking gallery </a>+
- +
-<a href= " http://adorable.awardspace.info/25-adorable-angel-christmas-crafting-favorite-featuring-gift-other-project-reindeer-snowman-yuletide.html " > 25 adorable angel christmas crafting favorite featuring gift other project reindeer snowman yuletide </a>+
- +
-<a href= " http://adorable.awardspace.info/adorable-baby-baby-bumble-bumbles-character-featuring-first-humble-humble-journal-journal-keepsake-three-years.html " > adorable baby baby bumble bumbles character featuring first humble humble journal journal keepsake three years </a>+
- +
-<a href= " http://adorable.awardspace.info/adorable-dog.html " > adorable dog </a>+

Current revision

Improvements that are not yet included on this page:
1. DHCP issue resolved
2. WPA/WPA2 didn't work with the steps I posted originally - Works with the updated instructions.
3. Firewall rules tightened up a bit. (The router is arguably "more secure" from the Wireless clients than with my last set of instructions)


[edit] No update yet

Almost a yearand still no update of the page... Towsonu2003 23:21, 7 Sep 2006 (CEST)

obviosly dead, need some input on this --whiteboy 05:26, 14 Dec 2006 (CET)

[edit] dnsmasq errors out with Can't bind 192.168.1.1 socket already in use

[edit] iptables vs. ebtables?

Is there any reason that isolation of (bridged) wireless interfaces can't be achieved with ebtables? As far as I can tell, I have been able to isolate both wireless interfaces with the following startup script:

insmod ebtables
insmod ebtable_filter
insmod ebtable_broute
insmod ebt_ip

#DHCP
ebtables -t filter -I INPUT 1 -p IPv4 --ip-proto udp --ip-dport 67 -j ACCEPT
#DNS
ebtables -t filter -I INPUT 2 -p IPv4 --ip-proto udp --ip-dport 53 -j ACCEPT
ebtables -t filter -I INPUT 3 -p IPv4 --ip-proto tcp --ip-dport 53 -j ACCEPT
#PROTECT ROUTER
ebtables -t filter -I INPUT 4 -p IPv4 -i eth1 --ip-dst 192.168.0.0/16 -j DROP
ebtables -t filter -I INPUT 5 -p IPv4 -i eth2 --ip-dst 192.168.0.0/16 -j DROP

#ISOLATE
ebtables -t filter -I FORWARD 1 -i eth1 -j DROP
ebtables -t filter -I FORWARD 2 -i eth2 -j DROP
ebtables -t filter -I FORWARD 3 -o eth1 -j DROP
ebtables -t filter -I FORWARD 4 -o eth2 -j DROP

#DHCP
ebtables -t filter -I OUTPUT 1 -p IPv4 --ip-proto udp --ip-sport 67 -j ACCEPT
#DNS
ebtables -t filter -I OUTPUT 2 -p IPv4 --ip-proto udp --ip-sport 53 -j ACCEPT
ebtables -t filter -I OUTPUT 3 -p IPv4 --ip-proto tcp --ip-sport 53 -j ACCEPT
#PROTECT ROUTER
ebtables -t filter -I OUTPUT 4 -p IPv4 -o eth1 --ip-src 192.168.0.0/16 -j DROP
ebtables -t filter -I OUTPUT 5 -p IPv4 -o eth2 --ip-src 192.168.0.0/16 -j DROP

--Tag 08:06, 14 February 2020 (CET)

Or, after removing from br0, why is it necessary to attach to a new bridge? Leaving the wireless interfaces unbridged leads to a nice, succinct startup script:
iptables -I FORWARD 1 -i eth1 -o ! vlan2 -j DROP
iptables -I FORWARD 2 -i eth2 -o ! vlan2 -j DROP
--Tag 21:54, 14 February 2020 (CET)